chmod 440
chmod 440 sets r--r-----: the owner and members of the group can read the file, nobody can write or execute it, and everyone else has no access.
Permission matrix
| Who | Read (4) | Write (2) | Execute (1) | Digit |
|---|---|---|---|---|
| Owner (u) | Yes | No | No | 4 |
| Group (g) | Yes | No | No | 4 |
| Others (o) | No | No | No | 0 |
Execute means different things by type. On a file it lets the kernel run it as a program. On a directory it is search permission: entering it (cd) and reaching the files inside by name. Read on a directory only lists names.
| Who | On a file | On a directory |
|---|---|---|
| Owner (u) | Read the contents | List names only; cannot enter or open entries |
| Group (g) | Read the contents | List names only; cannot enter or open entries |
| Others (o) | No access | No access |
Facts
| Octal | 440 (0440) |
|---|---|
| Symbolic | r--r----- |
| ls -l, file | -r--r----- |
| ls -l, directory | dr--r----- |
| Equivalent symbolic command | chmod ug=r,o= |
| Default umask that creates it | None of the common umasks; set it explicitly with chmod |
| How Git records a file with it | 100644 (not executable) |
| Special bits | None |
When to use it
- /etc/sudoers and drop-in files in /etc/sudoers.d: visudo writes them as 0440 owned by root, and sudo refuses to run with a sudoers file that others can write.
- wp-config.php and similar credential files: the WordPress hardening guide recommends 440 or 400 so other users on the server cannot read the database password. Use 440 when the web server reads it through the group.
When not to use it
- Files your application updates itself (installers, plugin managers): writes fail. Loosen temporarily, then set 440 again.
- When the group includes accounts that should not see the contents.
Adding a sudoers drop-in safely
Edit drop-ins with visudo so the syntax is checked before the file is installed; a broken sudoers file can lock you out of sudo. visudo -c verifies the modes and syntax of every file.
sudo visudo -f /etc/sudoers.d/deploy
sudo chmod 440 /etc/sudoers.d/deploy
sudo visudo -cCommands
sudo chmod 440 /etc/sudoers.d/deploy
sudo chmod ug=r,o= /etc/sudoers.d/deploy # same resultstat -c '%a %A %n' /etc/sudoers.d/deploy # Linux (GNU stat): 440 -r--r-----
stat -f '%Lp %Sp %N' /etc/sudoers.d/deploy # macOS and BSDApplying it to a whole tree
chmod -R would put the same mode on files and directories alike. Set directories to 550 and files to 440 separately:
find . -type d -exec chmod 550 {} +
find . -type f -exec chmod 440 {} +Or in one pass with a capital X, which adds execute only to directories and to files that already had it: chmod -R ug=rX,o= ..
Git and the execute bit
Git stores only one permission fact per file: 100755 if the owner execute bit is set, 100644 otherwise. A file with this mode is committed as 100644; the group and others bits never reach the repository. On Windows, or where core.fileMode is false, set the bit with git update-index --chmod=+x.
Frequently asked questions
- What does chmod 440 mean?
- Owner 4 (r--), group 4 (r--), others 0 (---).
- What permissions should /etc/sudoers have?
- 0440, owner root, group root. That is what visudo creates and what sudo expects.
- Should wp-config.php be 440 or 400?
- 400 if PHP runs as the file owner (common with PHP-FPM pools per site), 440 if PHP reads it through the group.
Last reviewed by Arielton Oberek.